Passing variables to /proc

Thaidog · 10-31-2010, 06:57 PM

I am trying to pass a variable to /proc with the following command:

yoyoyo@M5-N177:$ sudo echo "1" > /proc/sys/kernel/modules_disabled
bash: /proc/sys/kernel/modules_disabled: Permission denied

Not working as you can tell... what do I need to do? This is on ubuntu 10.10 - thx

stress_junkie · 10-31-2010, 07:24 PM

You could try starting a shell in root using either sudo -s or sudo su. Then when you have an interactive session as root you could try the command again. I don't want to test this myself. Seems like a bad idea to put 1 in that "file".

impert · 10-31-2010, 07:29 PM

If I tell you how to do it, will you tell me how to undo it? Seriously!
Ubuntu, by default, doesn't use a root password. You can, however, give it one, using sudo passwd root. You can then become root as you would in other distributions.

Code:

cam@cwpc:~$ su
Password: 
root@cwpc:/home/cam# echo "1" > /proc/sys/kernel/modules_disabled
root@cwpc:/home/cam# cat /proc/sys/kernel/modules_disabled
1
root@cwpc:/home/cam# echo "" > /proc/sys/kernel/modules_disabled
bash: echo: write error: Invalid argument
root@cwpc:/home/cam# echo " " > /proc/sys/kernel/modules_disabled
bash: echo: write error: Invalid argument

and trying to nano it gives

Code:

Error writing /proc/sys/kernel/modules_disabled: Invalid argument

when saving.

Why do you want to do this?

impert · 10-31-2010, 07:41 PM

It's not obvious to get rid of it:

Code:

root@cwpc:/home/cam# cat /dev/null > /proc/sys/kernel/modules_disabled
root@cwpc:/home/cam# cat /proc/sys/kernel/modules_disabled
1

Maybe a reboot will fix it.

Thaidog · 10-31-2010, 07:43 PM

Just saw this was a new security option and wanted to see what happened with it enabled and I load a module. I put the this line in /etc/sysctl.conf

modules_disabled = 1

Still it does not come back with 1 in proc when I do a cat.

impert · 10-31-2010, 07:44 PM

Quote:

Seems like a bad idea to put 1 in that "file".

You're probably right.

syg00 · 10-31-2010, 07:49 PM

It is designed not be be undo-able. Once set, that's it (deliberately) till reboot.

impert · 10-31-2010, 07:53 PM

Quote:

Seems like a bad idea to put 1 in that "file".

You're probably right.
After a reboot I've now got 0 in there. Is 0 better than nothing, I wonder? Anyhow, the sky hasn't fallen in. Yet.
Edit:
@syg00 Do you know what it does?

syg00 · 10-31-2010, 08:02 PM

Read this

Thaidog · 10-31-2010, 08:35 PM

Here is where I saw it:
https://wiki.ubuntu.com/Security/Fea...dule%20loading

impert · 11-01-2010, 06:21 AM

@syg00

thanks for the info:

Quote:

modules_disabled:
258
259A toggle value indicating if modules are allowed to be loaded
260in an otherwise modular kernel. This toggle defaults to off
261(0), but can be set true (1). Once true, modules can be
262neither loaded nor unloaded, and the toggle cannot be set back
263to false.

Quote:

Since some of the files _can_ be used to screw up your
15system, it is advisable to read both documentation and source
16before actually making adjustments.

Sounds grim. However, on rebooting it set itself to read 0, so I imagine no damage was done. I didn't try echoing "0" to it as I wasn't sure that this was a toggle. I wouldn't be surprised though if it is possible to echo "say hullo to mum" or anything you like to it - but only as root using su, not sudo

impert · 11-01-2010, 06:27 AM

@Thaidog: thanks to you, too, for the link. I've got some reading to do!

syg00 · 11-01-2010, 06:30 AM

That's just a general statement about sysctls. If you're root you can generally royally screw up your system.
With modules_disabled the kernel devs may have been trying to protect you (or your system) from yourself ...

tracyreed · 03-29-2012, 06:44 PM

I was googling for kernel.modules_disabled to see what others were saying and found this thread. I know this is an old thread and this was a new feature when the thread was started but I have been playing with this and want to add some commentary which nobody has so far hit upon...

This is a GREAT feature if you want to harden your system. Right now I'm looking at a Linux box with a kernel module based rootkit on it. Had this option been set this guy would not have been owned in this way. For servers, which generally get all of their modules loaded at boot time and then never need any more, this is a great option to employ to help protect the system.